Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just managed to setup OpenVPN properly on my server and test it to be properly working with client computers and I came to wonder how OpenVPN keys can be generated as clients come and go.

Is it neccessary to rebuild the diffie helman .dh file and recreate all previous client keys as I just need to add or remove a client?


share|improve this question
up vote 3 down vote accepted

As Ency says, provided you've created your own CA, you simply create another key for the new user. Before any more gets typed, when you set up openVPN you did create your own CA, as recommended, didn't you?

Edit: OK, then

cd easy-rsa
. ./vars
./build-key newclient

I also have some notes somewhere about making a CRL, which allows you to revoke old certificates, and pointing openVPN at the crl, but I can't immediately find them.

share|improve this answer
Yep! I did - the ca.crt file have been proven to be working! – Industrial Jan 31 '11 at 12:47
Hi again. Thanks for your edit, but doesn't this mean I have to rebuild the diffie helman? What would I need to do when I need to revoke access? – Industrial Jan 31 '11 at 16:34
You could rebuild the main CA key and redistribute it, or you can make a CRL - Certificate Revocation List. This is a list of certificates which despite being validly signed are no longer valid, in a very particular format, and also signed by your CA certificate. The openVPN doco will point you at how to do it, it's not complex, just fiddly. Once you've reconfigured your opeVPN server to use your CRL, keeping your CRL up-to-date is fairly straightforward. – MadHatter Jan 31 '11 at 18:10
So only the CA key would need to be redistributed and no other keys? – Industrial Jan 31 '11 at 19:58
If you regenerate the CA, all keys will have to be redistributed (because the root signing key will be new, so all the other keys will need re-signing). If you create a CRL, no keys have to be redistributed. – MadHatter Jan 31 '11 at 21:10

My solution is:
I have got my own Certificate Authority and anytime I need new client I just create another certificate. It is simple and I am pretty sure you can do same thing even with easyRSA delivered with openVPN.
It is also more universal, because you can easily manage certificates for another services such as apache, etc.

share|improve this answer
How does that work with revoking access to a client? – Industrial Jan 31 '11 at 19:00
There is a CRL list and you can easily revoke any certificate and I am using this command openssl ca -config conf/openssl.cnf -revoke newcerts/XX.pem -keyfile private/ca.key -cert ca/ca.crt, list of certificates is stored in index.txt (of course depends on your openSSL config) – Ency Jan 31 '11 at 20:18

Use duplicate-cn option and one key for all client or use easy-rsa for create user certification.

share|improve this answer
That would mean that I had to redistribute a new key to all clients if I need to restrict access to one user? – Industrial Jan 31 '11 at 12:18
Yes that is correct ! – Antoine Benkemoun Jan 31 '11 at 12:56

You can also tie the CN (that houses the user login name) of the user cert to a login that you can administer, for example, with FreeRADIUS. I wrote a small integration script couple of years ago. This way you can simply block user access by removing them from FreeRADIUS user list. The idea is that the certificate will protect the VPN from anyone else, and the FreeRADIUS login from the user itself (should the user's login need to be revoked). You can find the script and additional detail here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.